Guidance

Private sector COVID-19 testing provider: self-declaration privacy notice

Published 20 October 2020

© Crown copyright 2020

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/private-sector-covid-19-testing-provider-self-declaration-privacy-notice/private-sector-covid-19-testing-provider-self-declaration-privacy-notice

Introduction

The government has published guidance on the minimum standards for private sector providers of COVID-19 testing.

To request to be added to the indicative list of providers on GOV.UK, providers must declare that they meet these minimum standards by completing the form, as well as providing some additional information to support our due diligence checks.

The government envisages that UKAS accreditation will become a minimum standard for all private sector providers of COVID-19 testing at a future stage and is planned to be established by September 2021. Further information on the UKAS accreditation process is expected to be available by March 2021.

What personal data we collect

In order to complete the private sector provider self-declaration process and request publication of your organisation’s details on the list of private sector COVID-19 testing providers on GOV.UK, we need to process the following personal data.

Your organisation’s clinical or medical director or equivalent’s:

  • name
  • position in company
  • email
  • telephone
  • relevant clinical regulatory body or council registration number

For the person you employ with oversight responsibilities as a regulated healthcare scientist who is registered with the Health and Care Professions Council, their:

  • name
  • position in company
  • email
  • telephone
  • Health and Care Professions Council registration number

For the person who will be submitting the declaration on behalf of your organisation, their:

  • name
  • position in company
  • phone number
  • email address

Who has your personal data and what it will be used for

The Department of Health and Social Care (DHSC) is the data controller of personal data with regards to self-declaration process and it will share the personal data with its agencies and UKAS for the purposes of processing this form and publishing details on the list of providers on GOV.UK.

The personal data provided in this form will also be used by DHSC and UKAS to verify the information provided including the organisation’s registration details (with UKAS) and the registration details of medical or clinical personnel (for example, with the General Medical Council, Health and Care Professions Council, etc). The information will not be shared with third parties which are not connected with the self-declaration process.

Data processors

Personal Data will be processed by SocialOptic Limited who provide website, webform and data storage services to DHSC.

Personal data disposal and retention

We will only keep your personal data for as long as it is needed for the purposes for which it was collected, where we are required to do so and in line with our retention policies, in order to meet a regulatory or legal obligation and we will remove from our systems all personal data which is no longer required.

Data storage, security and international data transfers

We handle your personal data in accordance with adequate and reasonable procedures, in order to maintain and protect its security, availability, confidentiality and integrity, and prevent its unlawful or unauthorised processing, accidental loss or damage, from its collection until its destruction.

Your data will be stored and processed in the UK and will not be transferred outside of the European Economic Area (EEA).

Use of cookies

Our use of cookies is in line with the GOV.UK cookie guidance.

Automated decision-making

We do not engage in profiling or any processing related to automated decision-making activity.

DHSC’s legal basis for processing your personal data is:

  • GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

Your rights as a data subject

By law, you have a number of rights as a data subject and this does not take away or reduce these rights.

These rights are:

  • your right to get copies of your information – you have the right to ask for a copy of any information about you that is used
  • your right to get your information corrected – you have the right to ask for any information held about you that you think is inaccurate, to be corrected
  • your right to limit how your information is used – you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used
  • your right to object to your information being used – you can ask for any information held about you to not be used. However, this is not an absolute right, and we may need to continue using your information, and we will tell you if this is the case
  • your right to get information deleted – this is not an absolute right, and we may need to continue to use your information, and we will tell you if this is the case

If you are unhappy or wish to complain about how your personal data is used as part of this programme, you should contact the Data Protection Officer of DHSC, Lee Cramp, at lee.cramp@dhsc.gov.uk

If you are still not satisfied, you can complain to the Information Commissioners Office. Their website address is www.ico.org.uk.

Back to top